Identity Intelligence
Identity Intelligence recognises devices and actors across sessions — without cookies — and fuses hardware-level device fingerprinting with behavioral biometrics, bot/automation detection, browser-integrity checks and network intelligence into a single, real-time identity risk snapshot. One call returns top-line scores, per-domain signals, an explainable verdict surface, and a canonical identityRiskLevel.
Identity Intelligence is an evidence provider. Every analysis returns a risk score and a signal breakdown — it never blocks on its own. You stay in control: read the snapshot, apply your own rules, and decide what to do. There is no single "block/allow" field, because that decision is yours.
One snapshot, many signals
Instead of stitching together a dozen point tools, you make one request and receive one flat snapshot. Every sensitive event — a signup, a login, a checkout, a wallet transfer — is analysed against everything the service already knows about that device, that actor and that network, and the result is a coherent object you can store, replay and reason about.
The snapshot carries:
- Top-line scores —
riskScore,confidenceScore,similarityScore,stabilityScore. - A canonical verdict —
identityRiskLevel: clean | low | medium | high | critical, with anidentityRiskPolicyVersion. This is Identity's own evidence-grade assessment of the session — not a fraud or payment action. - Per-domain signals — device/continuity, behavioral, network, bot, mobile and tamper/privacy fields.
- An explainable surface —
reasonCodes,tags,riskFlagsandfindings[](each with acode,severity,scoreDeltaandsource), so every score is traceable to the evidence behind it.
See The Risk Snapshot for the full field reference.
Signal families
The snapshot is organised into families. Each has its own page with the fields it contributes and how to read them.
| Family | What it tells you | Page |
|---|---|---|
| Device, continuity & behavioral | Whether this device/browser has been seen before and how stable it is; same-actor probability; device clustering (device farms); typing/pointer biometrics — human vs scripted | Device & Continuity |
| Network intelligence | VPN / proxy / Tor / hosting detection, ASN, ISP, IP geolocation, geo conflicts and impossible travel | Network Intelligence |
| Bot & automation | Headless browsers, scripted checkout, credential stuffing, signup & trial abuse, and cryptographically declared "good bots" | Bot & Automation |
| Mobile threat | Hardware-attested app/device integrity, clone/multi-instance tooling, MITM/interception — via the native mobile SDK | Mobile Threat |
| POS / terminal threat | Terminal and cashier risk for physical points of sale — a separate B2B surface | POS / Terminal Threat |
How live each signal is
Not every signal is available in every deployment. It helps to think of three temperatures:
Default-on signals compute unconditionally from the session itself. Hosted-live signals are live in the hosted product, backed by continuously maintained intelligence. Enrollment-gated signals need you to register something first (a bot key, an app, a terminal) before they report a verified result.
- Default-on (live from the session, no feeds): device continuity & clustering, behavioral telemetry/biometrics, automation/bot detection, browser integrity/tamper, and declared-bot binding.
- Hosted-live (maintained network intelligence): VPN / proxy / Tor / hosting detection plus geo / ASN / ISP attribution. In the hosted product this is live.
- Enrollment-gated (configure first): verified good-bot allow-listing (register an issuer + key), iOS App Attest verified-trust, mobile app / malware integrity, and POS terminal threat. Until you enroll, these report an explicit unverified/not-applicable result rather than a pass.
Each signal page repeats the temperature that applies to it, so you always know what to expect before you rely on it.
Two ways to integrate
- In the browser — load the headless Web SDK, which collects device and behavioral telemetry and requests the snapshot for you. See Web SDK.
- From your server — call the analyze endpoints directly with your secret key, for example to score a backend event or to query past analyses. See Server-side API.
Both paths return the same snapshot shape. See Authentication for how each one is authorised.
Governance
For your compliance team, operators are separately provided permission-gated GDPR erasure (DSAR) and evidence-graph investigation tools — these are operator workflows, not merchant self-service endpoints, and are out of scope for this integration guide.